Explore the source
Start with the repository, follow development, and see how the platform is taking shape.
View on GitHub →3,006
non-human identities discovered across 14 connected sources
73%
owner-confirmed — the remaining 27% are tracked as unresolved, not as fine
4
evidence states kept separate from severity, never averaged into one score
0
owners ever assigned from a name match alone
Illustrative product scenarios throughout this page — not customer results or a live connected environment.
Open source at the core
The governance layer your identity stack never had.
SPIFFE and SPIRE issue workload identities. cert-manager renews certificates. OpenBao and Vault hold secrets. All of them do their job well, and none of them can tell you who is accountable for the service account that has been reaching production for 214 days. Nomyr's core is the open layer that answers that — designed for self-hosting and transparent, evidence-driven decisions.
git clone https://github.com/nomyr-security/nomyr.gitcd nomyrmake web-installmake test-fastmake build./bin/nomyr demoYour graph never leaves your network
Self-hosted means identity metadata, access paths and evidence stay inside your perimeter by construction — not because a vendor architecture promises it. Nomyr is designed around local control of evidence and explicitly authorized connections.
Source you can inspect
Explore the source, follow the decisions behind the product, and contribute improvements. Open development gives your team a direct way to understand the platform and shape what comes next.
Free and open source
Nomyr is free to explore, self-host, and contribute to. Build with the community, inspect the source, and help shape non-human identity security around the needs of your team.
What the inventory leaves out
An identity list is not an answer.
Every scanner can enumerate service accounts. The work starts at the three questions a flat list can't answer — and each one shapes the platform we’re building.
Who is accountable for this one?
Candidate owners are ranked from authoritative evidence — service-catalog fields, CODEOWNERS, creation events — with the evidence shown beside the confidence. When nothing authoritative exists, the identity stays unresolved rather than taking the nearest plausible name.
Rev Ops
Service catalog owner field
94%
Payroll Eng
CODEOWNERS + creation event
71%
DevEx
Repository responsibility
58%
No candidate
No authoritative field — left unresolved
—
How far does it reach?
Blast radius is scored on its own axis, beside severity — so a mid-severity finding on a widely-reachable identity stops hiding behind its rating.
Severity · mediumReach · 340 resources
Is that access actually effective?
Configured, observed and evaluated access are three different claims. Nomyr walks the real path, and when one policy condition can't be read it reports an unproven path — not an assumed allow, not an assumed deny.
3 of 4 hops evaluatedNot proven effective
What is coverage really telling you?
When a source loses log access, most tools quietly show an improvement. Nomyr separates what it can see from what it can prove — revoked log access marks usage coverage unknown, and never marks an identity inactive.
AWS Organizations
97%
HashiCorp Vault
100%
Okta
88% · rate limited
Active Directory
64% · usage unknown
The difference, on one identity
Same credential. Two very different reports.
An illustrative comparison for a 214-day-old key: a flat scanner record beside the evidence-rich view Nomyr is designed to provide.
Conventional scanner
identitybot-payroll-sync
credentialstatic API key · 214d
severityHIGH
ownerj.alvarez
coverage64% ▲ improved
status1 finding open
The owner is whoever created it — a contractor who left in March. Coverage “improved” because the source stopped returning logs. Both readings are wrong in the direction that feels reassuring.
Nomyr
identitybot-payroll-sync · mixed-use
credentialstatic API key · 214d · unvaulted
severityHIGH · confidence 96%
blast radius1 resource · no lateral reach
ownerUNRESOLVED · creator departed
coverage64% · usage coverage UNKNOWN
lifecyclestuck at OWNED
Same facts, none of them rounded toward comfort. High severity but narrow reach, an owner that is an open question with a named next action, and a coverage drop reported as a loss of evidence.
Beyond discovery
Then it has to actually get fixed.
Findings nobody can act on are just a longer list. Lifecycle runs, agent governance and a grounded assistant carry each one to a decision someone signed.
Lifecycle that admits where it's stuck
Provisioning, ownership, vaulting, rotation and retirement run as one auditable track. An identity parked at a stage shows which stage and why — here, no accountable owner means rotation policy has nobody to attach to.
A control plane for AI agents
Allow, flag or block what an agent may do, evaluated before the action executes and scoped by agent, team and resource. Agents with no declared manifest are flagged by default — visible immediately, never blocked blind.
Ask Nomyr drafts the fix, and still waits for you
The assistant works from the same evidence the screens show, cites the finding it is acting on, and writes the remediation step by step. It will not execute a production change without a human approving the plan — that boundary is a product decision, not a setting.
Cites its evidenceWaits for approval
Why is bot-payroll-sync still flagged after the rotation run?
RUN-9905 rotated the superseded key 7c1a…, not the active key 9f21…c04a — that one is still 214 days old and unvaulted. I've drafted a rotation for the right key.
POST-HYG-014RUN-9905key 9f21…
Draft ready · waiting for your approvalReview plan
Evidence you can hand to an auditor
Every decision is timestamped with its actor, and an evidence package replays to the same findings it was built from.
packageq3-access-review.evidence
sha2563f9a c21e … 7b04
replays to641 findings · identical
signed2 approvers · 18 Sep
Verified
Operating modes
You decide how much Nomyr is allowed to do.
Four operating modes in the Nomyr design. Explicit scope, human accountability, no silent escalation.
01
Observe
Discovers and evidences everything. Takes no automated action at all. Where every deployment starts.
02
Assisted
Proposes fixes and drafts the change for a human to approve. Nothing moves without a signature.
03
Policy-automated
Executes the low-risk, high-confidence actions you have defined. Everything else still routes to a person.
04
Enforced
Blocks non-compliant access at request time, where a supported enforcement point exists.
Free and open source
Yours to run. Ours to build together.
Explore the code, run Nomyr in your own environment, and help shape what comes next. An open project for teams who want control of their machine identity security.
Run it yourself
Build from source and try the local demo in your own environment with the getting-started guide.
Get started →Build with us
Bring your use cases, ideas, documentation, and code. Help make machine identity security better for everyone.
Contribute to Nomyr →Designed for your identity stack
Okta
Google Cloud
GitHub
GitLab
Jenkins
CircleCI
Vault
Plus AWS, Microsoft Entra ID, Azure, Google Workspace, Ping, Doppler, Venafi and Active Directory.
Get started
See your own identity graph, not a demo of someone else's.
Explore the open-source project, help shape machine identity security, or talk with us about your environment. Start with the source and see where Nomyr can fit into your identity stack.